dracut/0057-Extend-evm-enable.sh-to-load-the-EVM-public-key.patch

From 396d3cc7ff39e54ce2de1fa9389348238b0ed92e Mon Sep 17 00:00:00 2001
From: Mimi Zohar <zohar@linux.vnet.ibm.com>
Date: Mon, 27 Apr 2015 18:24:12 -0400
Subject: [PATCH] Extend evm-enable.sh to load the EVM public key

Create the _evm keyring and load the EVM public key on it.
---
 modules.d/98integrity/evm-enable.sh | 42 +++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/modules.d/98integrity/evm-enable.sh b/modules.d/98integrity/evm-enable.sh
index dee1c6c..ec4f03b 100755
--- a/modules.d/98integrity/evm-enable.sh
+++ b/modules.d/98integrity/evm-enable.sh
@@ -48,6 +48,45 @@ load_evm_key()
         info "integrity: failed to load the EVM encrypted key: ${EVMKEYDESC}";
         return 1;
     }
+    return 0
+}
+
+load_evm_x509()
+{
+    info "Load EVM IMA X509"
+
+    # override the EVM key path name from the 'evmx509=' parameter in
+    # the kernel command line
+    EVMX509ARG=$(getarg evmx509=)
+    [ $? -eq 0 ] && \
+        EVMX509=${EVMX509ARG}
+
+    # set the default value
+    [ -z "${EVMX509}" ] && \
+        EVMX509="/etc/keys/x509_evm.der";
+
+    # set the EVM public key path name
+    EVMX509PATH="${NEWROOT}${EVMX509}"
+
+    # check for EVM public key's existence
+    if [ ! -f "${EVMX509PATH}" ]; then
+        if [ "${RD_DEBUG}" = "yes" ]; then
+            info "integrity: EVM x509 cert file not found: ${EVMX509PATH}"
+	fi
+        return 1
+    fi
+
+    # load the EVM public key onto the EVM keyring
+    evm_pubid=`keyctl newring _evm @u`
+    EVMX509ID=$(evmctl import ${EVMX509PATH} ${evm_pubid})
+    [ $? -eq 0 ] || {
+	info "integrity: failed to load the EVM X509 cert ${EVMX509PATH}";
+	return 1;
+    }
+
+    if [ "${RD_DEBUG}" = "yes" ]; then
+        keyctl show @u
+    fi
 
     return 0
 }
@@ -76,6 +115,9 @@ enable_evm()
     # load the EVM encrypted key
     load_evm_key || return 1
 
+    # load the EVM public key, if it exists
+    load_evm_x509
+
     # initialize EVM
     info "Enabling EVM"
     echo 1 > ${EVMSECFILE}